A Safer Handover: Ten Questions UK Clients Should Ask Before Sending Data to an Adviser

Consultancy projects often begin with a transfer of information. Commercial plans, customer lists, employee records, pricing models and board papers may all be shared before a contract is fully settled. For a UK business, that handover is a practical necessity, but it is also a point of risk.

The law provides a framework. UK GDPR and the Data Protection Act 2018 place duties on organisations that control personal data, and on those that process it on another organisation’s behalf. Contracts and confidentiality agreements provide another layer. Neither is much use if the client never asks the right questions.

This checklist is not legal advice. It is a practical set of questions to ask before sharing sensitive material with a consultancy or adviser. A professional firm should welcome them. Vague assurances are a warning sign; clear answers, offered in writing, are a better indicator of genuine professionalism.

1. What exactly do you need, and why?

Start with data minimisation. Ask the adviser to specify the data they need, the purpose and the period for which it is required. A request to send everything is rarely necessary. In many cases, aggregated, anonymised or pseudonymised data will answer the question just as well.

A good adviser will help the client scope the request. They will explain why each category is needed and whether a sample would suffice. Reducing the data shared reduces the risk before any other control is considered.

2. Will you sign a mutual NDA, and what does it cover?

A non-disclosure agreement should be in place before detailed commercial discussions, not after. Ask whether it is mutual, how long it lasts, what happens to material on termination and what exceptions apply. Confidentiality clauses should cover permitted use, onward sharing and return or destruction.

An NDA is not a substitute for data protection terms. It protects confidentiality; it does not by itself govern personal data processing. The two should work together.

3. Are you a controller or processor for this work?

Roles matter. If the adviser processes personal data on the client’s behalf, the client is likely to be the controller and the adviser a processor. That usually requires a data processing agreement covering instructions, security, subprocessors, breach notification and deletion.

If the adviser is acting as an independent controller, the relationship is different. Ask them to explain their basis for processing and how they will meet their own obligations. Do not accept a one-line answer on a point this important.

4. Which subcontractors or affiliates will see the data?

Many consultancies use associates, subcontractors, group companies or offshore support. Ask who will have access, where they are located and what contractual obligations flow down to them. If subprocessors are used, the client should know how they are authorised and monitored.

Overseas transfers need particular attention. Ask what safeguards apply and whether any transfer mechanism is in place. A clear list of subprocessors is a sign of maturity; an evasive answer is not.

5. What AI tools will be used, and will our data go into them?

This question has become essential. Ask whether any generative AI tool will process the client’s data, whether inputs are used for model training, where data is stored and how long the tool retains it. Public tools should not be used for confidential client material without explicit agreement.

If AI is part of the workflow, the client should understand the controls. Are enterprise terms in place? Is data excluded from training? Is human review applied? The answers should be documented in the security schedule or data processing agreement.

6. How will you keep it secure?

Security questions should be specific. Ask about access controls, encryption, multi-factor authentication, device management and storage location. Ask who within the consultancy can see the data and how access is removed when staff leave a project.

Certifications such as Cyber Essentials or ISO 27001 can provide useful evidence, but they are not a guarantee. The client should still understand the practical controls that apply to their particular data.

7. How long will you keep it, and how will you delete it?

Retention should be agreed at the start. Ask how long data will be held, whether it will be returned in a usable format and how deletion will be confirmed. Backups need to be considered too, along with any legal or regulatory reason to retain material.

A deletion certificate or written confirmation is reasonable for sensitive data. The client should also know what happens to working papers, drafts and extracts after the project ends.

8. What happens if there is a breach?

Ask who will notify whom, how quickly and by what method. Under UK GDPR, a processor must notify the controller without undue delay after becoming aware of a personal data breach. The controller then assesses whether the ICO must be notified within 72 hours and whether individuals need to be told.

A practical breach clause should include contact details, escalation routes and an obligation to help with the assessment. It should not leave the client to discover the problem through a third party.

9. Who owns the working papers and outputs?

Ownership is often assumed rather than agreed. Ask who owns the final deliverables, the underlying models, the drafts, the methodologies and any data extracted during the work. The client should also know what licence they have to use the adviser’s tools or frameworks after the project.

Advisers may legitimately retain general know-how and methodologies. Client data and client-specific working papers are a different matter. The contract should make the position clear before work begins.

10. Can we audit or ask for evidence?

A right to audit, or a lighter right to request evidence, gives the client a route to check compliance. Not every client will use it, but the existence of the right matters. Ask for a security questionnaire, subprocessor list or independent assurance report where appropriate.

Also ask for an exit plan. How will data be returned, deleted and confirmed? What happens to access after the engagement? A clean exit is part of good data handling, not an afterthought.

Putting the checklist into practice

Use a short data handover schedule for each project. Record what is being shared, why, with whom and for how long. Start with anonymised or sample data where possible, and add categories only when the adviser can justify them.

The aim is not to make every project heavy. It is to separate clear professionalism from vague reassurance. A consultancy that answers these questions plainly, in writing and without irritation is likely to handle the work with the same care. If the answers are evasive, that is useful information before the first file is sent.